CVE-2026-110322
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields duri
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-822
Not enough EPSS history yet.
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
- github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-01.json
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
- www.hms-networks.comhttps://www.hms-networks.com/cybersecurity
- www.peak-system.comhttps://www.peak-system.com/support/downloads/software/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-195956.1 MED—
——0The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread.
An unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invoke the rtio_cqe_get_mempool_buffer() syscall with buff/buff_len pointing at memory it may read but not write, and with a completion-queue entry whose flags field it fully controls (only RTIO_CQE_FLAG_MEMPOOL_BUFFER in flags[7:0] is required; flags[19:8] and flags[31:20] supply the block index and count). The kernel then performs a pointer-sized and a 4-byte store through those addresses while running in supervisor mode. Reaching the store requires CONFIG_USERSPACE together with CONFIG_RTIO_SYS_MEM_BLOCKS, the configuration behind RTIO_DEFINE_WITH_MEMPOOL; without the latter the implementation returns -ENOTSUP and writes nothing.
Two outcomes follow. If the target lies in a memory-domain partition declared K_MEM_PARTITION_P_RW_U_RO (privileged read-write, user read-only), the kernel-mode store succeeds and deposits partly attacker-chosen values into memory the memory domain had marked read-only for that thread, bypassing the partition's write protection. If the target lies in globally readable but unwritable memory such as .text/.rodata in flash, the store faults in kernel mode; the fault is delivered to z_fatal_error() and the default k_sys_fatal_error_handler() halts or reboots the device, giving an unprivileged thread a reliable full denial of service.
The read-permission check does bound the damage: the address must still be readable by the calling thread, so kernel-private memory cannot be targeted and no confidential data is disclosed. The fix replaces both checks with K_SYSCALL_MEMORY_WRITE(), so a thread lacking write permission is terminated by K_OOPS before the implementation runs; the cqe argument correctly remains read-validated.11hCVE-2026-1084356.5 MED42.6%
——13Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.19hCVE-2026-969337.8 HIG22.5%
——7Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.5dCVE-2026-969317.8 HIG22.5%
——7Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.5dCVE-2026-969249.8 CRI58.2%
——17Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.4dCVE-2026-969105.5 MED32.4%
——10Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.5d